Real fee ranges for executive tabletop facilitation in 2026

Cost of a Cybersecurity Tabletop Exercise

Executive cybersecurity tabletop exercises are priced differently from keynote speaking engagements. The exercise is a working session with the actual leadership team, not a presentation to an audience. Pricing reflects the preparation, facilitation, and after-action depth required to surface and document the 18 to 36 hours of recoverable response time most exercises produce. In 2026, executive tabletop exercise fees from top-tier facilitators typically fall in three tiers based on format and depth. Tier one (typically $15,000 to $25,000): Half-day virtual exercises with a single scenario, 8 to 15 executive participants, and a basic after-action report. Right for organizations conducting their first executive tabletop, smaller leadership teams, and exercises with a focused single-vector scenario (ransomware, business email compromise, or supply chain compromise as standalone events). Tier two (typically $25,000 to $40,000): Full-day in-person or hybrid exercises with a complex multi-vector scenario (often ransomware combined with disclosure window pressure or AI-enabled fraud), 15 to 25 executive participants, custom scenario development tied to the organization's actual infrastructure and regulatory environment, and a detailed after-action report with named remediation owners. This is the band where most mid-market and enterprise organizations book. Tier three (typically $40,000 to $50,000+): Multi-day exercises with complex inter-organizational coordination, large leadership groups (25+), custom scenario development including OT/IT convergence or AI-specific attack categories, and an after-action report structured to feed the next cyber insurance renewal and SEC disclosure framework. Right for Fortune 500 enterprises, critical infrastructure operators, and organizations with high regulatory or insurance scrutiny. Mark Lynd has facilitated more than 150 executive tabletop exercises across financial services, healthcare, energy, manufacturing, transportation, education, and the public sector. The exercise methodology is built around the 72-Hour IR Executive Playbook and is structured to surface findings that map directly to cyber insurance renewal questions and SEC disclosure preparation. Most exercises produce an after-action report that documents the 18 to 36 hours of recoverable response time and produces a named remediation roadmap with 30, 60, and 90-day milestones. What is included in the standard quote: pre-exercise scoping call with executive leadership, custom scenario development tied to the host organization's environment, full facilitation of the exercise, real-time injects calibrated to participant responses, after-exercise debrief, and a written after-action report within two weeks. Extras priced separately: full incident-response playbook update following the exercise, follow-on quarterly tabletops, multi-day off-site facilitation, and integration with cyber insurance renewal-prep workshops. Government, educational, nonprofit, and SLED rates are available for qualifying organizations. Veteran-led and federal contracting organizations may also qualify. Reach out through the contact form with desired exercise date, executive participant count, primary scenario focus (ransomware, BEC, OT, AI-enabled, supply chain, multi-vector), and your cyber insurance renewal timeline if applicable.

Live on stage · International keynote